MetaPermit: Scalable and Auditable Access Control for AI Agents via LLM-Inferred Meta-Attributes
MetaPermit uses inferred meta-attributes and a fixed policy to authorize AI-agent tool calls more consistently and resist prompt injection.
MetaPermit is a tool access-control framework for AI agents that separates semantic inference from security enforcement. An LLM infers compact, task-independent meta-attributes describing user intent, execution context, and the proposed tool call, and a fixed policy then allows or denies the call so the decision remains auditable. The authors contrast this with coarse rules used around systems such as OpenAI Codex and Claude Code and with inconsistent LLM-only authorization exposed to indirect prompt injection. On AgentDojo and AgentDyn, across seven suites, five attack methods, and two open-weight LLMs, it was 31% more consistent, improved task completion by up to 109% versus CaMeL and IPIGuard, and executed no malicious tool calls.
- An LLM infers meta-attributes and a fixed policy allows or denies each tool call.
- The design targets brittle static permissions and inconsistent LLM authorization.
- Tests covered AgentDojo, AgentDyn, seven task suites, and five attack methods.
- Authorization was 31% more consistent, and no malicious tool calls were executed.
Full article262 words · extracted from arxiv.org · click to collapse
The rise of autonomous AI agents equipped with tools has introduced significant security risks, ranging from unintended tool misuse to adversarial manipulation through Indirect Prompt Injection (IPI) attacks. In practice, deployed agent systems such as OpenAI Codex and Claude Code protect tool invocations through a combination of coarse-grained permission rules and LLM-based judgments about individual proposed actions. Both components, however, have important limitations: static policies must anticipate possible user intents and therefore do not scale to open-ended tasks, while LLM-driven authorization supports dynamic decisions but produces inconsistent outcomes and remains vulnerable to targeted IPI attacks. To provide scalable and more consistent authorization, we propose MetaPermit, a policy-based tool access-control framework that decouples semantic inference from security enforcement. By analyzing agent-user interactions, we derive a compact, task-independent set of meta-attributes that capture the relationships among the user's intent, the execution context, and the proposed tool call. These meta-attributes allow MetaPermit to authorize tool use without enumerating user intents. At runtime, an LLM infers the meta-attribute values for each proposed tool call, while a fixed policy evaluates these values to allow or deny the call, making each decision auditable through the inferred values and the applied policy rule. We evaluate MetaPermit on the AgentDojo and AgentDyn benchmarks, across seven task suites and five attack methods, using two widely deployed open-weight LLMs. The results show that MetaPermit produces 31% more consistent authorization decisions than LLM-driven authorization and outperforms the state-of-the-art defenses CaMeL and IPIGuard in both task completion, with improvements of up to 109%, and robustness to IPI attacks, with no malicious tool calls executed.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.31039